July 16, 2019—KB4507459 (OS Build 14393.3115)

Applies to: Windows 10 Version 1607Windows Server 2016

Highlights


  • Updates an issue that affects applications that manage files, folders, and device settings.
  • Improves compatibility with the Window-Eyes screen reader application.

Improvements and fixes


This update includes quality improvements. Key changes include:

  • Addresses an issue that may prevent the personal identification number (PIN) prompt from appearing when authenticating in Internet Explorer. 
  • Addresses an issue with leaking Windows notification sockets that causes Windows to run out of ports. 
  • Updates time zone information for Brazil. 
  • Addresses an issue that displays the Power button on the Ctrl+Alt+Del screen when the "User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands" policy is enabled. 
  • Addresses an issue that fails to bypass automatic sign in (Autologon) when you press and hold the Shift key during startup. 
  • Addresses an issue that may prevent the Netlogon service from establishing a secure channel and reports the error, “0xC000007A – ERROR_PROC_NOT_FOUND.” 
  • Addresses an issue that causes Windows Defender Application Control to generate too many events related to dynamic code generation. 
  • Addresses an issue that causes applications that use windows.storage.dll to stop working and displays ExceptionCode c0000005 (Access violation) when the process closes. 
  • Addresses an issue that causes the Storage Spaces Direct (S2D) pool to lose Pool Quorum and prevents access to the S2D volumes if you restart one of the S2D cluster nodes. 
  • Addresses an issue in Microsoft Remote Desktop Web Access (RDWeb) that allows user passwords to be updated even if there is a "Confirm New Password" field error. 
  • Addresses an issue that may cause a Remote Desktop Server to stop responding when someone who is using drive redirection disconnects. 
  • Addresses an issue that may prevent some applications from running as expected on clients of Active Directory Federation Services 2016 (AD FS 2016) after installing KB4493473 on the server. Applications that may exhibit this behavior use an IFRAME during non-interactive authentication requests and receive X-Frame Options set to DENY.
  • Addresses an issue that prevents Microsoft Application Virtualization (App-V) scripting from working if you run it when you’re not connected to a domain controller (DC). App-V scripting also fails when you run it in an environment that only contains Microsoft Azure Active Directory.
  • Addresses an issue with opening or using the Window-Eyes screen reader application that may result in an error and prevent some features from functioning as expected.
  • Addresses an issue that may cause a cluster node to lose membership in a cluster and cause all its workloads to fail over. This issue may occur when a cluster node creates a Live Dump.
  • Addresses an issue that prevents hosts that are managed by System Center Virtual Machine Manager (SCVMM) from enumerating and managing the logical switches deployed on the hosts. Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the hosts.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

Known issues in this update


Symptom Workaround
After installing KB4467684, the cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the group policy “Minimum Password Length” is configured with greater than 14 characters.

Set the domain default "Minimum Password Length" policy to less than or equal to 14 characters.

Microsoft is working on a resolution and will provide an update in an upcoming release.

Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

Do one of the following:

  • Perform the operation from a process that has administrator privilege.
  • Perform the operation from a node that doesn’t have CSV ownership.
Microsoft is working on a resolution and will provide an update in an upcoming release.
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error "Status: 0xc0000001, Info: A required device isn't connected or can't be accessed" after installing this update on a WDS server.

For mitigation instructions, see KB4512816.

We are working on a resolution and will provide an update in an upcoming release.

Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of this update. Devices that are domain controllers or domain members are both affected.

If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

This issue is resolved in KB4512517.
Internet Explorer 11 may fail to render some JavaScript after installing this update. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

To mitigate this issue, you need to Enable Script Debugging using one of the following ways.

You can configure the below registry key:

Registry setting: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

Value: Disable Script Debugger

Type: REG_SZ

Data: no

Or you can Enable Script Debugging in Internet Settings. You can open Internet Setting by either typing Internet Settings into the search box on Windows or by selecting Internet Options in Internet Explorer. Once open, select Advanced then Browsing and finally, select Enable Script Debugging.

We are working on a resolution and will provide an update in an upcoming release.
Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.” We are working on a resolution and will provide an update in an upcoming release.

How to get this update


Before installing this update

Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU. For more information, see Servicing stack updates.

If you are using Windows Update, the latest SSU (KB4509091) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog

Install this update

Release Channel Available Next Step
Windows Update or Microsoft Update Yes Go to Settings > Update & Security > Windows Update and select Check for updates.
Microsoft Update Catalog Yes To get the standalone package for this update, go to the Microsoft Update Catalog website.
Windows Server Update Services (WSUS) No

You can import this update into WSUS manually. See the Microsoft Update Catalog for instructions.

File information

For a list of the files that are provided in this update, download the file information for cumulative update 4507459.